Confidentiality policy

Purpose of policy:

Confidentiality is important to us. The protection of information is a core part of our commitment to honesty, rigour and transparency.

The purpose of this policy is to enable the UK Research Integrity Office (UKRIO) to:

  • protect the users of UKRIO’s services, in particular, those using our Advisory Service;
  • protect UKRIO’s staff, volunteers, other individuals and subscribers; and
  • protect the organisation from the consequences of a breach of its responsibilities.

A PDF version of this policy is also available.

Confidentiality

Confidentiality applies not only to our ‘Privacy Policy’ but to a much wider range of information processed or stored by UKRIO. Accordingly, all UKRIO staff and volunteers must adhere to the following requirements:

What information is confidential?

In general terms, confidentiality applies to:

  • Information which falls within the scope of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (see UKRIO’s Privacy Policy).
  • Information about other organisations, since the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 only apply to information about individuals.
  • Information which is not recorded, either on paper or electronically.
  • Information held on paper, but in a sufficiently unstructured way that it does not meet the definition of a ‘relevant filing system’ in the Data Protection Act.
  • Information about UKRIO that is not publicly available. For example, its plans or finances.
  • Information about the use of UKRIO’s services. In particular, this includes information relating to the use of UKRIO’s Advisory Service. The additional confidentiality provisions relating to the Advisory Service are given below.

Exceptions to information about the use of UKRIO’s services would be:

  • Any anonymised, aggregate data which we may publish to illustrate the work of UKRIO. However, such information would not identify any individuals or organisations, unless we have obtained explicit permission to do so.
  • Any case studies which we may publish as training or educational material. Case studies will always be anonymised and published with the permission of the service user(s) who brought the matter to our attention.
  • Note that UKRIO also creates fictional scenarios for educational and training purposes. These illustrative ‘case study’ scenarios draw upon UKRIO’s experiences in assisting with issues of research integrity but are not based on any particular real-life situation. No individuals or organisations are named in these scenarios.

How is confidential information stored?

See ‘Privacy policy’.

Who has access to confidential information?

Access to confidential information is based on the principle of least privilege; in short, limited to information that is relevant to a person’s work. In addition, regardless of whether a person can access confidential information or not, that information must always be stored and communicated in a secure fashion: right to access information does not obviate security requirements.

In general terms, UKRIO staff and volunteers have access to confidential information as follows:

  • The Board of Trustees directs and oversees the strategy and programme of work of UKRIO. It also has responsibility for matters of organisational administration and the management of the Office team. The Trustees include the Chair and Vice-Chair of UKRIO.

Accordingly, the Board of Trustees may access whatever confidential information it needs to discharge its responsibilities. This includes, but is not limited to, detailed information about UKRIO’s finances, matters relating to the employment and management of staff, matters relating to the recruitment and management of volunteers, strategic and operational plans, and the operation and use of UKRIO’s services.

Trustees have access to information relating to UKRIO’s Advisory Service as necessary. Information relating to specific enquiries will normally be anonymised, but Trustees can access non-anonymised data if required.

  • UKRIO Volunteers (also referred to as UKRIO Expert Community): provide an expert resource which UKRIO draws upon when responding to enquiries on issues of research conduct. Recognising their broad experience in research matters, volunteers also give feedback on the wider work of UKRIO on request and are given the opportunity to contribute to other elements of the programme of work. Volunteers hold no legal responsibility for the organisation. Some volunteers in this group are also Trustees.

The main role of volunteers is to assist UKRIO in formulating responses to requests for assistance. Volunteers therefore have access to information regarding specific enquiries made to UKRIO’s Advisory Service; however, this would normally be anonymised information only. Further information is provided under ‘Confidentiality relating to UKRIO’s Advisory Service’, below.

  • The Office team provides administrative, policy, research and technical support to the Trustees and carries out UKRIO’s programme of work of the project under their direction.
  • Associates of UKRIO, including contractors or consultants providing services to the charity, also provide administrative, policy, research and technical support to the Office team, and in turn helps to ensure UKRIO’s programme of work is carried out under the direction of the Office team.

Members of the Office team have access to confidential information that is appropriate to their duties. This can include personal data relating to service users and volunteers, and information regarding UKRIO’s Advisory Service, including specific enquiries. Associates of UKRIO may also have access to such confidential information.

Sharing information with organisations that fund, subscribe to, or otherwise support, UKRIO

UKRIO was initially funded as a pilot project by a broad stakeholder group, including the UK Higher Education Funding Councils, the UK Departments of Health, the Research Councils, the Royal Society, research charities and a variety of other organisations. It is now a registered charity, and its funders are mostly higher education institutions, though it is possible that funding sources will diversify as the charity grows.

Our policy is that external funding will not divert UKRIO from its agreed aims and values. Donations to UKRIO do not entitle any individual or organisation to decision-making authority and no individual funding source should be of a magnitude that would allow it to exercise control or compromise in any significant way the independence of UKRIO.

Accordingly, our funders do not determine who we help or how we help them. UKRIO does not share confidential information on its work – for example, who has sought our advice, what their concerns were or how we assisted them with the organisations that support us. Also see ‘Privacy Policy’.

Confidentiality relating to UKRIO’s Advisory Service

Confidentiality governs how we handle information once we receive it. All information received in the course of an advice enquiry is treated in confidence, and we will only use the information provided to help with the enquiry.

There are some situations where we may need to share information outside of our service. For example, where there is a lawful basis to do so, where there is a serious risk to safety, or where you have asked us to act on your behalf. Any external sharing will be limited to what is strictly necessary for the purpose, and wherever possible, we will discuss this with you first. The Privacy Policy, which should be read alongside this policy, sets out the legal grounds that permit us to process that information in the first place.

The following confidentiality provisions apply to information relating to UKRIO’s Advisory Service, including but not limited to: information about service users; any information provided by service users; and information about our responses to enquiries made to the Advisory Service.

  • UKRIO will keep a confidential record of any requests for assistance and all subsequent discussions for internal purposes.
  • No other parties will be informed without the enquirer’s consent, unless clear evidence of criminal activity has been presented, there is an immediate need to involve others to prevent further risk or harm to people, animals or the environment, or UKRIO is otherwise under a legal obligation to do so.
  • UKRIO strongly recommends that enquiries are anonymised where possible, especially those from organisations.
  • UKRIO also reserves the right to disclose details of our advice and correspondence if that advice is later misrepresented by the enquirer.
  • The above provisions are communicated to users of UKRIO’s Advisory Service, via emails acknowledging requests for assistance, reminder of the Terms of use for accessing the service, for example. Service users are also provided with information on UKRIO’s role and remit.

Details of how and when UKRIO may share information with other organisations is set out in the Privacy Policy.

Communication with staff and volunteers

Staff and volunteers will be required to sign a short statement indicating that they have been made aware of their confidentiality and privacy responsibilities (see Appendix A).

Staff training and acceptance of responsibilities

Documentation / related policies

This policy should be read in conjunction with the following UKRIO policies and procedures:

Induction

All staff who have access to any kind of personal data will have their responsibilities outlined during their induction procedures.  

Appropriate guidance on Data Protection and the General Data Protection Regulation (see UKRIO’s Privacy Policy) will be given to volunteers on their induction.

Continuing training

UKRIO will provide opportunities for staff to explore Data Protection issues through training.

Procedure for staff and volunteers signifying acceptance of policy.

Staff, associates, volunteers and Trustees will be asked to sign to accept the provisions of this policy: see Appendix 1.

Procedure for staff and volunteers signifying acceptance of policy

Staff and volunteers will be asked to sign to accept the provisions of this policy: see Appendix 1.  

Appendix A: Confidentiality statement for staff and volunteers

When working or volunteering for UKRIO, you will often need to have access to confidential information as part of performing in your role. We must handle this information with integrity and respect.

Who this appendix applies to:

  • All full time and part time employees
  • All volunteers
  • Contractors, consultants, or other associates providing services to the charity
  • Trustees

Employees and associates

In addition to the examples outlined in the standard Confidentiality Policy, you may need to access to information such as:

  • Personal information about individuals who are users of UKRIO’s services, members of UKRIO subscriber institutions or otherwise involved in the activities organised by UKRIO (note that this type of information is not normally shared with volunteer Advisers).
  • Information about the internal business of UKRIO, including sensitive information regarding UKRIO’s strategy and decision making, finances, legal, compliance and HR matters, whether shared within the formal governance structure (for example, Board or sub-committee meetings), or on an ad-hoc basis.
  • Personal information about colleagues working or volunteering for UKRIO.

In addition to the examples outlined in the standard Confidentiality Policy and above, in particular you must:

Keep physical Board papers in a secure, private location, guard them responsibly while on your person, and dispose of them by shredding once they are no longer required.

Volunteers

In addition to the examples outlined in the standard Confidentiality Policy, you may need to access to information such as:

  • Personal information about individuals who are users of UKRIO’s services, members of UKRIO subscriber institutions or otherwise involved in the activities organised by UKRIO (note that this type of information is not normally shared with volunteer Advisers).
  • Information about the internal business of UKRIO.
  • Personal information about colleagues working or volunteering for UKRIO.

In addition to the examples outlined in the standard Confidentiality Policy and employee, associate and volunteer sections above, all employees, associates and volunteers must:

  • not compromise or seek to evade security measures (including computer passwords);
  • be particularly careful when sending information between UKRIO and volunteers; for example checking recipient names
  • not gossip about confidential information, either with colleagues, volunteers, associates or people outside UKRIO; and
  • not disclose information — especially over the telephone — unless you are sure that you know who you are disclosing it to and that they are authorised to have it.

Trustees

As a Trustee of UKRIO, you hold a unique legal and ethical position of trust.

In addition to the examples outlined in the standard Confidentiality Policy and above, you may need to access to information such as:

  • Information about the internal business of UKRIO, including sensitive information regarding UKRIO’s strategy and decision making, finances, legal, compliance and HR matters, whether shared within the formal governance structure (for example, Board or sub-committee meetings), or on an ad-hoc basis.
  • Personal information about colleagues working or volunteering for UKRIO.

In addition to the examples outlined in the standard Confidentiality Policy and above, in particular you must:

  • keep physical Board papers in a secure, private location, guard them responsibly while on your person, and dispose of them by shredding once they are no longer required.

Statement

UKRIO is committed to keeping the above types of information confidential, in order to protect people and UKRIO itself. ‘Confidential’ means that all access to information must be on a need to know and properly authorised basis. You must use only the information you have been authorised to use, and for purposes that have been authorised. You should also be aware that under the Data Protection Act, unauthorised access to data about individuals is a criminal offence.

You must assume that information is confidential unless you know that it is intended by UKRIO to be made public. Passing information between the UKRIO office and volunteers (note that volunteers are not normally provided with unanonymised information about requests for UKRIO’s help) or vice versa does not count as making it public, but passing information to another organisation does count.

You must also be particularly careful not to disclose confidential information to unauthorised people or cause a breach of security.

If you are in doubt about whether to disclose information or not, do not guess. Withhold the information while you check with an appropriate person whether the disclosure is appropriate.

Your confidentiality obligations continue to apply indefinitely after you have stopped working for UKRIO.

Please read the statement below, sign and date the form, and return it via email as soon as possible to: info@ukrio.org

I have read and understand the above Confidentiality Policy and Confidentiality  statement. I accept my responsibilities regarding confidentiality.  

 

Signed ……………………………………                                Date ……………………………………

This page was last updated on 4/11/2026